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This report sought to assess whether campuses of the 
State University of New York (SUNY) have established adequate 
controls for safeguarding cash collections at peripheral locations. 
An audit of 33 selected peripheral locations, such as libraries, 
intercollegiate athletics, telecommunications, and student 
advisement, was conducted between April 1992 and December 1993 . 
Attention was focused on those operations that were identified 
through a preliminary survey as having the greatest probability for 
needing improvement. The audit found that none of the 33 locations 
had established all of the basic controls necessary for safeguarding 
cash collections, as mandated by state regulations. At 27 locations 
cash handling duties were not adequately segregated from the duties 
of maintaining cash accounting records, while at 23 locations no 
independent reconciliation of daily cash collections was made to cash 
receipts records. At 21 locations, checks were not restrict ively 
endorsed upon receipt to ensure that they would not be negotiated to 
inappropriate parties. The report recommends that campuses consider 
an evaluation of the overall peripheral location cash collection risk 
exposure and the development and issuance of necessary directives to 
correct cash control weaknesses. Two appendixes list the major 
contributors to the report and the comments of SUNY officials. 
(MDM) 
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TO THE EDUCATIONAI 



State of New York 

Office of the State Comptroller 



Division of Management Audit 
Report 94-S-27 

Dr. Joseph C. Burke 

Interim Chancellor 

State University of New York 

University Plaza 

Albany, New York 12246 

Dear Dr. Burke: 

The following is our report on the State University of New York's 
internal controls over cash collections at selected campus peripheral cash 
collection locations. 

This audit was performed pursuant to the State Comptroller's authority 
as set forth in Section 1, Article V of the State Constitution and Section 
8, Article 2 of the State Finance Law. 

This report was prepared under the direction of Frank J. Houston, Audit 
Director. Major contributors to this report are listed in Appendix A. 




August 10, 1994 



Executive Summary 



State University of New York - Internal Controls 
Over Cash Collections at Selected Campus 
Peripheral Locations 



Scope Of Audit The State University of New York (SUNY) includes 29 State-operated 

campuses and is one of the largest higher education systems in the 
nation. A 16-member Board of Trustees sets SUNY policy, while a 
Central Administration Unit provides direction and leadership for the 
SUNY system. Each campus is responsible for implementing an internal 
control system to protect campus assets. 

SUNY campuses collect revenues in excess of $1 billion annually. Most 
of this revenue is for student tuition and room and board charges and is 
collected at campus central sites, such as the Bursar* s Office or the 
Student Accounts Office. However, a total of about $89 million is 
collected annually at campus peripheral locations. These collections 
generally cover charges for such items as telecommunications, library 
fees, parking permits and campus event ticket sales. 

The State Comptroller's User Procedure Manual (Manual) provides basic 
guidelines and internal control standards for State agencies to establish 
and maintain controls over cash. Cash is an asset that can be easily 
misdirected or stolen and, therefore, is considered to have a high 
inherent control risk. An effective system of internal control diminishes 
this risk, and provides reasonable assurance that all cash which should 
be received is actually received and is promptly recorded and deposited. 
In addition, the 1987 New York State Governmental Accountability, 
Audit and Internal Control Act (Internal Control Act) requires that all 
State agencies, including SUNY, establish an internal control review 
program designed to identify internal control weaknesses and to 
determine actions needed to correct these weaknesses. All agencies must 
annually certify their compliance with the Internal Control Act to the 
Division of the Budget. 

Our audit addressed the following question relative to the internal 
controls over cash collections at 33 selected peripheral locations on seven 
SUNY campuses for the period April 1, 1992 through December 10, 
1993: 

• Have the campuses established controls necessary for adequately 
safeguarding cash collections at peripheral locations? 
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Audit Observations 
and Conclusions 



We found that none of the 33 peripheral locations we visited established 
all the basic controls necessary for safeguarding cash collections. 
Consequently, to varying degrees the cash at each of the peripheral 
locations is now subject to some degree of avoidable risk. While we did 
not detect any instances of fraud, theft or misuse of funds, the absence 
of controls increases risk and makes detection of such incidents difficult. 

Some of the observations we made include: 

• At 27 locations, with $7.7 million of estimated annual revenue, cash 
handling duties were not adequately segregated from the duties of 
maintaining cash accounting records. 

• At 23 locations, with $6.2 million of estimated annual revenue, no 
independent reconciliation of daily cash collections was made to cash 
receipt records. Generally, the same staff who performed cash 
reconciliations also had other cash-related duties. 

• At 21 locations, checks were not restrictively endorsed upon receipt 
to ensure that these instruments would not be negotiated to inappropriate 
parties. 

We also found that campuses were not treating peripheral cash collection 
locations as assessable units for internal control purposes. Moreover, 
internal control training programs for staff had not been completed at 
several locations we visited. We believe that these conditions may have 
contributed to the problems we found with the peripheral location cash 
collection activities. We also found that our prior audits, as well as 
those of SUNY internal audit staff, identified similar weaknesses 
associated with various cash collection locations. The continuance of die 
same type of weaknesses over cash collection activities suggests that 
SUNY Central Administration needs to take a more active role with these 
campuses to ensure compliance with Manual guidelines and the provi- 
sions of the Internal Control Act. 

We also believe that the extent of the control weaknesses we found 
warrants SUNY Central Administration's evaluation of the risk exposure 
at peripheral cash collection locations throughout the SUNY system. 
Based upon this evaluation, SUNY should take action as necessary, to 
ensure that all campuses strengthen cash controls. 



Comments of 
SUNY Officials 



SUNY officials agree with our recommendations and indicate steps are 
being taken to implement them. 
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Introduction 



Background The State University of New York (SUNY) is one of the largest higher 

education systems in the nation. Its teaching, public service and research 
mission is conducted by 29 State-operated campuses and by five State- 
funded colleges located at Cornell and Alfred Universities. 

A 16-member Board of Trustees sets SUNY policy and a Central 
Administration Unit provides direction and leadership for the SUNY 
system. Each campus manages all aspects of campus operations, 
including implementation of internal controls that safeguard assets and 
ensure the accuracy and integrity of financial records. 

Each campus collects revenues such as tuition, room and board, and 
other student charges. For the 12-month period ended June 30, 1993, 
SUNY reported that campus revenue collections totaled in excess of 
$1 billion. The collection of most revenues takes place at campus 
central locations such as the Student Accounts Office or the Bursar's 
Office. However, cash is also collected at various other campus 
locations; the number of these peripheral locations varies among the 
campuses depending on the needs of individual campus operations. 
These collections are typically for such items as parking fees and 
permits, library fines and fees, telecommunication charges and ticket 
sales for campus events. SUNY reports that for the 12-month period 
ended June 30, 1993, total cash collections from peripheral locations 
were about $89 million. 

The State Comptroller's User Procedure Manual provides basic guidelines 
and internal control standards for State agencies, such as SUNY 
campuses, to establish and maintain controls over cash. In addition, the 
1987 Governmental Accountability, Audit and Internal Control Act 
(Internal Control Act) specifies that internal control training, risk 
assessment and an internal control review program, including corrective 
action plans, are necessary elements of an effective system of internal 
control. 
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Audit Scope, 
Objectives and 
Methodology 



We audited the internal controls SUNY campuses maintain over cash 
collections at selected peripheral locations for the period April 1, 1992 
through December 10, 1993. The objective of our performance audit 
was to determine whether the campuses we visited have established the 
necessary controls over cash collections at peripheral locations. To 
accomplish this objective, we visited 33 selected peripheral cash 
collection locations at seven SUNY campuses: Albany, Alfred, 
Bir^hamton, Brockport, Farmingdale, Oswego and Plattsburgh. These 
locations have total estimated annual revenues of $9.6 million. At each 
campus, we reviewed control procedures, interviewed management and 
staff, and examined relevant transactions and records. We also observed 
and tested operations at selected peripheral cash collection locations. 

We conducted our audit in accordance with generally accepted govern- 
ment auditing standards. Such standards require that we plan and 
perform our audit to adequately assess those operations of SUNY which 
are included within bur audit scope. Further, these standards require 
that we understand SUNY's internal control structure and its compliance 
with those laws, rules and regulations that are relevant to SUNY's 
operations which are included in our audit scope. An audit includes 
examining, on a test basis, evidence supporting transactions recorded in 
the accounting and operating records and applying such other auditing 
procedures as we consider necessary in the circumstances. An audit also 
includes assessing the estimates, judgments, and decisions made by 
management. We believe that our audit provides a reasonable basis for 
our findings, conclusions, and recommendations. 

We use a risk-based approach to select activities to be audited* This 
approach focuses our audit efforts on those operations that have been 
identified through a preliminary survey as having the greatest probability 
for needing improvement. Consequently, by design, finite audit 
resources are used to identify where and how improvements can be 
made. Thus, little effort is devoted to reviewing operations that may be 
relatively efficient and effective. As a result, our audit reports are 
prepared on an "exception basis." This report, therefore, highlights 
those areas needing improvement and does not address activities that may 
be functioning properly. 



Response of SUNY 
Officials to Audit 



A draft copy of this report was provided Jx> SUNY officials for their 
review and comment. Their comments have been considered in 
preparing this report and are included as Appendix B. 

Within 90 days after final release of this report, as required by Section 
170 of the Executive Law, the Chancellor of the State University of New 
York shall report to the Governor, the State Comptroller, and the leaders 
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of the Legislature and fiscal committees, advising wtat steps were taken 
to implement the recommendations contained herein, and where 
recommendations were not implemented, the reasons therefor. 



Adequacy of Internal Controls 



An effective system of internal control provides reasonable assurance that 
all cash which should be received is actually received and is promptly 
recorded and deposited. Since cash is an asset that can be easily 
misdirected or stolen, Section 3.0200 of the State Comptroller's User 
Procedure Manual (Manual) provides basic guidelines and internal control 
standards for State agencies to establish and maintain controls over 
checks, cash or money orders. Generally, these controls are not costly 
to implement, and each control is important in ensuring that cash is not 
stolen. Consistent with the Manual's specifications, campus management 
should provide staff at each peripheral cash collection location with 
written procedures that describe the major steps necessary in the cash 
control process. Management should inform this staff of their responsi- 
bility for the safekeeping of cash, and ensure they implement the 
following basic controls: 

• Use sequentially, press-numbered receipt forms to establish account- 
ability for each cash collection transaction. 

• Segregate the duties of handling cash from the duties of maintaining 
cash accounting records. This segregation helps to ensure that no one 
person exercises so much control over cash transactions that cash is at 
risk. 

• Assign the custody of financial stationery and the control of inventory 
records to employees who are independent of the cashiering function. 

• Require that checks be restrictively endorsed when received to prevent 
their negotiation to inappropriate parties. 

• Require that, at prescribed intervals - daily if feasible, but no less 
than once each week - moneys revived at cash collection locations be 
turned over for deposit. The timely deposit of funds reduces the 
likelihood of loss or theft of the funds. 

• Perform an independent reconciliation of cash receipts to cash deposits 
and accounting records. 

• Prominently display a sign advising individuals making payments to 
request a receipt. There is less likelihood of misappropriation of 
remittances when customers ask cashiers for receipts. 
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We visited 33 selected peripheral collection locations at seven SUNY 
campuses to determine the extent to which the above cash controls were 
implemented. We found that none of the peripheral locations established 
all the basic controls necessary for safeguarding cash collections. 
Consequently, to varying degrees, the cash collected at the locations is 
now subject to some degree of avoidable risk. (Exhibit A summarizes 
the status of controls for each of the 33 locations we reviewed.) 

Some of our observations include: 

• At 10 locations, staff did not use sequential, press-numbered receipt 
forms or other means of control to establish accountability over funds 
received. These locations had estimated annual revenues totaling over 
$2.2 million, including estimated annual collections of $1.2 million for 
telecommunication services at Oswego. 

• At 27 locations, campus officials did not adequately segregate cash 
handling and financial recordkeeping duties. This increases the risk that 
cash thefts would not be detected. The 27 locations with this weakness 
had estimated annual revenues totaling over $7.7 million. One Alfred 
peripheral location reporting about $120,000 in annual collections, uses 
the same employee to handle cash, record receipts, prepare bank deposits 
and reconcile account information. 

• At 23 locations, there were no independent reconciliations of cash 
collections to cash receipts records to detect any cash shortages on a 
timely basis. These locations had estimated annual revenues totaling 
over $6.2 million. 

• At 21 locations, checks were not restrictively endorsed upon receipt. 
At one Binghamton location, with about $244,000 of annual collections, 
checks were endorsed only once a week, increasing the risk tha* checks 
could be cashed inappropriately. 

• At 11 locations, there was no inventory control over the financial 
stationery. Seven of these locations did not use campus receipt forms. 
Rather, they ordered their own receipt forms from local vendors and 
maintained accountability of their own inventory stock. 

We found that, while circumstances and the extent of control implemen- 
tation varied at the 33 locations, three factors may have contributed to 
the generally inadequate controls over peripheral cash collections at the 
campuses we visited: inadequate internal control training; assessments 
that overlooked a cash collection function; and a lack of corrective action 
plans. For example, we found that five of the seven campuses have not 
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implemented an internal control training program. Therefore, staff, 
including those responsible for cash management at the peripheral 
locations, may not be aware of the risks to cash assets and the controls 
necessary to address the risks. In addition, although SUNY Central 
Administration provided an internal control training handbook to the 
campuses in October 1992, administrative officials at these five campuses 
had not yet distributed the material to their employees at the time of our 
field visits in late 1993. 

Three of the seven campuses we visited had not established internal 
control systems that included corrective action plans, as specified in the 
Internal Control Act. Another two campuses had partially implemented 
plans as part of their internal control reviews; however, the plans did not 
include cash collection activities for operations where cash collection is 
not a primary function. For example, although the library at the 
Oswego campus collected over $88,500 in fines and fees annually, cash 
collection was not included in the campus* assessment of the library's 
activities. Therefore, campus management may not have been aware of 
the peripheral location's cash control weaknesses or of the need to 
formulate corrective action plans to address the weaknesses. 

Internal control training, risk assessment and corrective action plans, are 
control elements required by the Internal Control Act. State agencies, 
including SUNY campuses, are subject to this legislation and were 
required to comply with its provisions by April 1, 1989. Agencies, 
including SUNY, must file an annual certification of continued compli- 
ance with the Internal Control Act to the Division of the Budget. 

Our prior campus audits, as well as those performed by SUNY's internal 
audit staff, have identified cash collection control weaknesses similar to 
those in this report at many of the same campuses. For example, 
previous audits we performed at Albany, Alfred, Brockport, Oswego and 
Plattsburgh identified cash control weaknesses like the ones cited in this 
report. The continuance of the same types of weaknesses in cash 
collection activities suggests that SUNY Central Administration needs to 
take a more active role in control implementation to ensure that 
campuses comply with both Manual cash control guidelines and the 
Internal Control Act's provisions. 

We believe that the weaknesses we found with peripheral cash collection 
locations may be symptomatic of peripheral cash control weaknesses 
throughout SUNY campuses. Therefore, SUNY Central Administration 
should consider an overall evaluation of this risk area and the develop- 
ment of directives for campuses to follow to ensure that all weaknesses* 
are corrected* We recognize that campuses are primarily responsible for 
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implementing internal controls over their operations; however, we believe 
that the continuance of systemic weaknesses in a particular area warrants 
direction and oversight by SUNY Central Administration. Such actions 
are consistent with SUNY Central Administration's leadership role in the 
SUNY system. 



Recommendations 

L Ensure that the campuses correct the weaknesses detailed in 
this report and summarized in Exhibit A of this report. 

2, Consider an evaluation of the overall peripheral location cash 
collection risk exposure and the development and issuance of 
necessary directives for campuses to follow to correct cash 
control weaknesses. 



SUNY 

SUMMARY OF CASH CONTROL WEAKNESSES 
AT SELECTED PERIPHERAL LOCATIONS 





LOCATION 


ESTIMATED ANNUAL 
RECEIPTS 


CONTROL 
WEAKNESSES 


ALBANY: 
Parking Management 
Bua Service* 
Library 

College Registrar 


S 440,492 
153,814 
294,992 
7,657 


4,6 
3, 4, 6, 7 
6 

2, 3, 6, 8 


ALFRED: 
Wcllavilk 
Chemical Testing 
Student Advisement 
Farm Operation 


S 123,218 
69,241 
120,967 
188,467 


4.5 
1. 3, 5, 6, 8 
3, 5, 6, 7, 8 

3, 5 


BINGHAMTON: 
Traffic Office 
Telecommunication* 
Anderaon Center 
Continuing Education 
s ? Conference Houiing 


$ 300,000 
1,500,000 
400,000 
244,163 
200,000 


3, 5, 6, 8 

3.5 
3. 5. 7. 8 
2. 3, 4, 5, 6 
3. 5. 7 


BROCKPORT: 
Public Safety 
Telecommunicationa 
Recreation 
Intercol. Athletics 
Overseas Program 


$ 405,795 
700,352 
180,925 
61,718 
627,321 


3. 4, 5 
3 
3.4 
2. 3. 4. 5, 6. 8 
3. 4, 8 


FARMINGDALE: 
Library 
Flower Shop 
Dental Clinic 
Continuing Education 
Placement Center 


$ 8,000 
26,700 
23,300 
286,500 
56,000 


6. 7. 8 
3. 5. 6 
3. 5, 6, 8 
2. 3, 5, 6 
2, 3. 5. 6 


OSWEGO: 
Telccommuiiications 
Library 
Public Safety 
Student Advisement 
Residential Housing 


$1,220,323 
88,517 

462,131 
52,615 

311,261 


1. 2, 3, 5, g 
5, 6, 8 

3. 5, 6, 8 

2, 3. 4, 5, 8 

2, 3, 4, 5, 6, 7, 8 


PLATTSBURGH: 
Registrar 
Infirmary 

Telecommunications 
Field House 
Library 


£ OQ *7Kf\ 

# zy, ou 
25,000 
874,967 
34,077 
71,575 


1, 2, 3, 5, 6, 7 

1.2, 3, 5,6 
6 

1.3, 4, 5,7 
I. 3.6 



1 . Lacked written cash control procedures. 

2. Sequentially, press-numbered receipt forms were not used. 

3. Cash duties were not adequately separated. 

4. Custody of financial atationery waa not independent of cash function.. 

5. Cash reformations were not performed by an individual independent of 
the cash functions. 

6. Checks were not restrictively endorsed upon receipt. 

7. Receipts were not deposited at least once a week. 

8. Lacked signs advising individuals to request a receipt. 
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Exhibit A 
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Major Contributors to This Report 



Jerry Barber, Audit Manager 
Arthur R Smith, Audit Supervisor 
Donald Wilson, Auditor-in-Charge 
Richard Gerard, Lead Auditor 
Karen Willard, Staff Auditor 
Amritesh Singh, Staff Auditor 
Andrew Fischler, Staff Auditor 
Nancy Varley, Report Editor 
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OFFICE OF THE STATE COMPTROLLER 

ROBERT' ■'.''TV-ORE 
0 c-..jtyC ?».-.. JUE"« 



State University of New York 
Sute University Plaza 
Albany, New York 12246 



JUL V*to 



Office of the Vice Chancellor 
for Finance and Busmess 



:«..JM-. AUDli& 

FINANCIAL REPORTING 



July 5, 1994 



Mr. Robert H. Attmore 
Deputy Comptroller 
Office of the State Comptroller 
The State Office Building 
Albany, New York 12236 

Dear Bob: 

In accordance with Section 170 of the Executive Law, we are enclosing the com- 
ments of State University of New York regarding the Draft Audit Report on the Internal 
Controls Over Cash Collections at Selected Campus Peripheral Cash Collection 
Locations, State University of New York (94-S-27). 



Sincerely, 




WilKam H. Anslow 
Senior Vice Chancellor 
for Finance and Management 



Enc. 
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State University of New York Comments 



/ 

1. The campuses have implemented a significant number of the control procedures 
necessary to resolve the control issues referenced in Exhibit A. In situations where 
staffing limitations preclude the campuses from instituting the specified control, the 
campuses have indicated they will consider alternative procedures. 

2. The University believes that strong internal controls over cash collections at remote 
sites are an important aspect of our overall internal control structure. Therefore, 
in response to the findings in this audit report, the University Controller's Office is 
in the process of preparing an internal control bulletin to be distributed University- 
wide on this subject. The bulletin will identify the major elements of internal control 
necessary covering remote cash collections, as well as guidance on the manner 
in which these controls should be put in place and monitored. The University also 
agrees with the Comptroller's findings that the remote cash collection activities be 
part of the overall vulnerability assessments performed by campus locations in 
compliance with the Internal Control Act. The internal control bulletin will also 
provide guidance in reference to this aspect as well. 
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